xref: /openbmc/qemu/target/arm/ptw.c (revision e0091133)
1 /*
2  * ARM page table walking.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/range.h"
12 #include "qemu/main-loop.h"
13 #include "exec/exec-all.h"
14 #include "cpu.h"
15 #include "internals.h"
16 #include "idau.h"
17 
18 
19 typedef struct S1Translate {
20     ARMMMUIdx in_mmu_idx;
21     ARMMMUIdx in_ptw_idx;
22     bool in_secure;
23     bool in_debug;
24     bool out_secure;
25     bool out_rw;
26     bool out_be;
27     hwaddr out_virt;
28     hwaddr out_phys;
29     void *out_host;
30 } S1Translate;
31 
32 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
33                                uint64_t address,
34                                MMUAccessType access_type, bool s1_is_el0,
35                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
36     __attribute__((nonnull));
37 
38 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
39                                       target_ulong address,
40                                       MMUAccessType access_type,
41                                       GetPhysAddrResult *result,
42                                       ARMMMUFaultInfo *fi)
43     __attribute__((nonnull));
44 
45 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
46 static const uint8_t pamax_map[] = {
47     [0] = 32,
48     [1] = 36,
49     [2] = 40,
50     [3] = 42,
51     [4] = 44,
52     [5] = 48,
53     [6] = 52,
54 };
55 
56 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
57 unsigned int arm_pamax(ARMCPU *cpu)
58 {
59     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
60         unsigned int parange =
61             FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
62 
63         /*
64          * id_aa64mmfr0 is a read-only register so values outside of the
65          * supported mappings can be considered an implementation error.
66          */
67         assert(parange < ARRAY_SIZE(pamax_map));
68         return pamax_map[parange];
69     }
70 
71     /*
72      * In machvirt_init, we call arm_pamax on a cpu that is not fully
73      * initialized, so we can't rely on the propagation done in realize.
74      */
75     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) ||
76         arm_feature(&cpu->env, ARM_FEATURE_V7VE)) {
77         /* v7 with LPAE */
78         return 40;
79     }
80     /* Anything else */
81     return 32;
82 }
83 
84 /*
85  * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index
86  */
87 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
88 {
89     switch (mmu_idx) {
90     case ARMMMUIdx_E10_0:
91         return ARMMMUIdx_Stage1_E0;
92     case ARMMMUIdx_E10_1:
93         return ARMMMUIdx_Stage1_E1;
94     case ARMMMUIdx_E10_1_PAN:
95         return ARMMMUIdx_Stage1_E1_PAN;
96     default:
97         return mmu_idx;
98     }
99 }
100 
101 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
102 {
103     return stage_1_mmu_idx(arm_mmu_idx(env));
104 }
105 
106 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
107 {
108     return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
109 }
110 
111 /* Return the TTBR associated with this translation regime */
112 static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
113 {
114     if (mmu_idx == ARMMMUIdx_Stage2) {
115         return env->cp15.vttbr_el2;
116     }
117     if (mmu_idx == ARMMMUIdx_Stage2_S) {
118         return env->cp15.vsttbr_el2;
119     }
120     if (ttbrn == 0) {
121         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
122     } else {
123         return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
124     }
125 }
126 
127 /* Return true if the specified stage of address translation is disabled */
128 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
129                                         bool is_secure)
130 {
131     uint64_t hcr_el2;
132 
133     if (arm_feature(env, ARM_FEATURE_M)) {
134         switch (env->v7m.mpu_ctrl[is_secure] &
135                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
136         case R_V7M_MPU_CTRL_ENABLE_MASK:
137             /* Enabled, but not for HardFault and NMI */
138             return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
139         case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
140             /* Enabled for all cases */
141             return false;
142         case 0:
143         default:
144             /*
145              * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
146              * we warned about that in armv7m_nvic.c when the guest set it.
147              */
148             return true;
149         }
150     }
151 
152     hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure);
153 
154     switch (mmu_idx) {
155     case ARMMMUIdx_Stage2:
156     case ARMMMUIdx_Stage2_S:
157         /* HCR.DC means HCR.VM behaves as 1 */
158         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
159 
160     case ARMMMUIdx_E10_0:
161     case ARMMMUIdx_E10_1:
162     case ARMMMUIdx_E10_1_PAN:
163         /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
164         if (hcr_el2 & HCR_TGE) {
165             return true;
166         }
167         break;
168 
169     case ARMMMUIdx_Stage1_E0:
170     case ARMMMUIdx_Stage1_E1:
171     case ARMMMUIdx_Stage1_E1_PAN:
172         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
173         if (hcr_el2 & HCR_DC) {
174             return true;
175         }
176         break;
177 
178     case ARMMMUIdx_E20_0:
179     case ARMMMUIdx_E20_2:
180     case ARMMMUIdx_E20_2_PAN:
181     case ARMMMUIdx_E2:
182     case ARMMMUIdx_E3:
183         break;
184 
185     case ARMMMUIdx_Phys_NS:
186     case ARMMMUIdx_Phys_S:
187         /* No translation for physical address spaces. */
188         return true;
189 
190     default:
191         g_assert_not_reached();
192     }
193 
194     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
195 }
196 
197 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
198 {
199     /*
200      * For an S1 page table walk, the stage 1 attributes are always
201      * some form of "this is Normal memory". The combined S1+S2
202      * attributes are therefore only Device if stage 2 specifies Device.
203      * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00,
204      * ie when cacheattrs.attrs bits [3:2] are 0b00.
205      * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie
206      * when cacheattrs.attrs bit [2] is 0.
207      */
208     if (hcr & HCR_FWB) {
209         return (attrs & 0x4) == 0;
210     } else {
211         return (attrs & 0xc) == 0;
212     }
213 }
214 
215 /* Translate a S1 pagetable walk through S2 if needed.  */
216 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
217                              hwaddr addr, ARMMMUFaultInfo *fi)
218 {
219     bool is_secure = ptw->in_secure;
220     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
221     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
222     uint8_t pte_attrs;
223     bool pte_secure;
224 
225     ptw->out_virt = addr;
226 
227     if (unlikely(ptw->in_debug)) {
228         /*
229          * From gdbstub, do not use softmmu so that we don't modify the
230          * state of the cpu at all, including softmmu tlb contents.
231          */
232         if (regime_is_stage2(s2_mmu_idx)) {
233             S1Translate s2ptw = {
234                 .in_mmu_idx = s2_mmu_idx,
235                 .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS,
236                 .in_secure = is_secure,
237                 .in_debug = true,
238             };
239             GetPhysAddrResult s2 = { };
240 
241             if (!get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
242                                     false, &s2, fi)) {
243                 goto fail;
244             }
245             ptw->out_phys = s2.f.phys_addr;
246             pte_attrs = s2.cacheattrs.attrs;
247             pte_secure = s2.f.attrs.secure;
248         } else {
249             /* Regime is physical. */
250             ptw->out_phys = addr;
251             pte_attrs = 0;
252             pte_secure = is_secure;
253         }
254         ptw->out_host = NULL;
255         ptw->out_rw = false;
256     } else {
257         CPUTLBEntryFull *full;
258         int flags;
259 
260         env->tlb_fi = fi;
261         flags = probe_access_full(env, addr, MMU_DATA_LOAD,
262                                   arm_to_core_mmu_idx(s2_mmu_idx),
263                                   true, &ptw->out_host, &full, 0);
264         env->tlb_fi = NULL;
265 
266         if (unlikely(flags & TLB_INVALID_MASK)) {
267             goto fail;
268         }
269         ptw->out_phys = full->phys_addr;
270         ptw->out_rw = full->prot & PAGE_WRITE;
271         pte_attrs = full->pte_attrs;
272         pte_secure = full->attrs.secure;
273     }
274 
275     if (regime_is_stage2(s2_mmu_idx)) {
276         uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
277 
278         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
279             /*
280              * PTW set and S1 walk touched S2 Device memory:
281              * generate Permission fault.
282              */
283             fi->type = ARMFault_Permission;
284             fi->s2addr = addr;
285             fi->stage2 = true;
286             fi->s1ptw = true;
287             fi->s1ns = !is_secure;
288             return false;
289         }
290     }
291 
292     /* Check if page table walk is to secure or non-secure PA space. */
293     ptw->out_secure = (is_secure
294                        && !(pte_secure
295                             ? env->cp15.vstcr_el2 & VSTCR_SW
296                             : env->cp15.vtcr_el2 & VTCR_NSW));
297     ptw->out_be = regime_translation_big_endian(env, mmu_idx);
298     return true;
299 
300  fail:
301     assert(fi->type != ARMFault_None);
302     fi->s2addr = addr;
303     fi->stage2 = true;
304     fi->s1ptw = true;
305     fi->s1ns = !is_secure;
306     return false;
307 }
308 
309 /* All loads done in the course of a page table walk go through here. */
310 static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
311                             ARMMMUFaultInfo *fi)
312 {
313     CPUState *cs = env_cpu(env);
314     void *host = ptw->out_host;
315     uint32_t data;
316 
317     if (likely(host)) {
318         /* Page tables are in RAM, and we have the host address. */
319         data = qatomic_read((uint32_t *)host);
320         if (ptw->out_be) {
321             data = be32_to_cpu(data);
322         } else {
323             data = le32_to_cpu(data);
324         }
325     } else {
326         /* Page tables are in MMIO. */
327         MemTxAttrs attrs = { .secure = ptw->out_secure };
328         AddressSpace *as = arm_addressspace(cs, attrs);
329         MemTxResult result = MEMTX_OK;
330 
331         if (ptw->out_be) {
332             data = address_space_ldl_be(as, ptw->out_phys, attrs, &result);
333         } else {
334             data = address_space_ldl_le(as, ptw->out_phys, attrs, &result);
335         }
336         if (unlikely(result != MEMTX_OK)) {
337             fi->type = ARMFault_SyncExternalOnWalk;
338             fi->ea = arm_extabort_type(result);
339             return 0;
340         }
341     }
342     return data;
343 }
344 
345 static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
346                             ARMMMUFaultInfo *fi)
347 {
348     CPUState *cs = env_cpu(env);
349     void *host = ptw->out_host;
350     uint64_t data;
351 
352     if (likely(host)) {
353         /* Page tables are in RAM, and we have the host address. */
354 #ifdef CONFIG_ATOMIC64
355         data = qatomic_read__nocheck((uint64_t *)host);
356         if (ptw->out_be) {
357             data = be64_to_cpu(data);
358         } else {
359             data = le64_to_cpu(data);
360         }
361 #else
362         if (ptw->out_be) {
363             data = ldq_be_p(host);
364         } else {
365             data = ldq_le_p(host);
366         }
367 #endif
368     } else {
369         /* Page tables are in MMIO. */
370         MemTxAttrs attrs = { .secure = ptw->out_secure };
371         AddressSpace *as = arm_addressspace(cs, attrs);
372         MemTxResult result = MEMTX_OK;
373 
374         if (ptw->out_be) {
375             data = address_space_ldq_be(as, ptw->out_phys, attrs, &result);
376         } else {
377             data = address_space_ldq_le(as, ptw->out_phys, attrs, &result);
378         }
379         if (unlikely(result != MEMTX_OK)) {
380             fi->type = ARMFault_SyncExternalOnWalk;
381             fi->ea = arm_extabort_type(result);
382             return 0;
383         }
384     }
385     return data;
386 }
387 
388 static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
389                              uint64_t new_val, S1Translate *ptw,
390                              ARMMMUFaultInfo *fi)
391 {
392     uint64_t cur_val;
393     void *host = ptw->out_host;
394 
395     if (unlikely(!host)) {
396         fi->type = ARMFault_UnsuppAtomicUpdate;
397         fi->s1ptw = true;
398         return 0;
399     }
400 
401     /*
402      * Raising a stage2 Protection fault for an atomic update to a read-only
403      * page is delayed until it is certain that there is a change to make.
404      */
405     if (unlikely(!ptw->out_rw)) {
406         int flags;
407         void *discard;
408 
409         env->tlb_fi = fi;
410         flags = probe_access_flags(env, ptw->out_virt, MMU_DATA_STORE,
411                                    arm_to_core_mmu_idx(ptw->in_ptw_idx),
412                                    true, &discard, 0);
413         env->tlb_fi = NULL;
414 
415         if (unlikely(flags & TLB_INVALID_MASK)) {
416             assert(fi->type != ARMFault_None);
417             fi->s2addr = ptw->out_virt;
418             fi->stage2 = true;
419             fi->s1ptw = true;
420             fi->s1ns = !ptw->in_secure;
421             return 0;
422         }
423 
424         /* In case CAS mismatches and we loop, remember writability. */
425         ptw->out_rw = true;
426     }
427 
428 #ifdef CONFIG_ATOMIC64
429     if (ptw->out_be) {
430         old_val = cpu_to_be64(old_val);
431         new_val = cpu_to_be64(new_val);
432         cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
433         cur_val = be64_to_cpu(cur_val);
434     } else {
435         old_val = cpu_to_le64(old_val);
436         new_val = cpu_to_le64(new_val);
437         cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
438         cur_val = le64_to_cpu(cur_val);
439     }
440 #else
441     /*
442      * We can't support the full 64-bit atomic cmpxchg on the host.
443      * Because this is only used for FEAT_HAFDBS, which is only for AA64,
444      * we know that TCG_OVERSIZED_GUEST is set, which means that we are
445      * running in round-robin mode and could only race with dma i/o.
446      */
447 #ifndef TCG_OVERSIZED_GUEST
448 # error "Unexpected configuration"
449 #endif
450     bool locked = qemu_mutex_iothread_locked();
451     if (!locked) {
452        qemu_mutex_lock_iothread();
453     }
454     if (ptw->out_be) {
455         cur_val = ldq_be_p(host);
456         if (cur_val == old_val) {
457             stq_be_p(host, new_val);
458         }
459     } else {
460         cur_val = ldq_le_p(host);
461         if (cur_val == old_val) {
462             stq_le_p(host, new_val);
463         }
464     }
465     if (!locked) {
466         qemu_mutex_unlock_iothread();
467     }
468 #endif
469 
470     return cur_val;
471 }
472 
473 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
474                                      uint32_t *table, uint32_t address)
475 {
476     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
477     uint64_t tcr = regime_tcr(env, mmu_idx);
478     int maskshift = extract32(tcr, 0, 3);
479     uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
480     uint32_t base_mask;
481 
482     if (address & mask) {
483         if (tcr & TTBCR_PD1) {
484             /* Translation table walk disabled for TTBR1 */
485             return false;
486         }
487         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
488     } else {
489         if (tcr & TTBCR_PD0) {
490             /* Translation table walk disabled for TTBR0 */
491             return false;
492         }
493         base_mask = ~((uint32_t)0x3fffu >> maskshift);
494         *table = regime_ttbr(env, mmu_idx, 0) & base_mask;
495     }
496     *table |= (address >> 18) & 0x3ffc;
497     return true;
498 }
499 
500 /*
501  * Translate section/page access permissions to page R/W protection flags
502  * @env:         CPUARMState
503  * @mmu_idx:     MMU index indicating required translation regime
504  * @ap:          The 3-bit access permissions (AP[2:0])
505  * @domain_prot: The 2-bit domain access permissions
506  * @is_user: TRUE if accessing from PL0
507  */
508 static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx,
509                          int ap, int domain_prot, bool is_user)
510 {
511     if (domain_prot == 3) {
512         return PAGE_READ | PAGE_WRITE;
513     }
514 
515     switch (ap) {
516     case 0:
517         if (arm_feature(env, ARM_FEATURE_V7)) {
518             return 0;
519         }
520         switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
521         case SCTLR_S:
522             return is_user ? 0 : PAGE_READ;
523         case SCTLR_R:
524             return PAGE_READ;
525         default:
526             return 0;
527         }
528     case 1:
529         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
530     case 2:
531         if (is_user) {
532             return PAGE_READ;
533         } else {
534             return PAGE_READ | PAGE_WRITE;
535         }
536     case 3:
537         return PAGE_READ | PAGE_WRITE;
538     case 4: /* Reserved.  */
539         return 0;
540     case 5:
541         return is_user ? 0 : PAGE_READ;
542     case 6:
543         return PAGE_READ;
544     case 7:
545         if (!arm_feature(env, ARM_FEATURE_V6K)) {
546             return 0;
547         }
548         return PAGE_READ;
549     default:
550         g_assert_not_reached();
551     }
552 }
553 
554 /*
555  * Translate section/page access permissions to page R/W protection flags
556  * @env:         CPUARMState
557  * @mmu_idx:     MMU index indicating required translation regime
558  * @ap:          The 3-bit access permissions (AP[2:0])
559  * @domain_prot: The 2-bit domain access permissions
560  */
561 static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
562                          int ap, int domain_prot)
563 {
564    return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
565                                 regime_is_user(env, mmu_idx));
566 }
567 
568 /*
569  * Translate section/page access permissions to page R/W protection flags.
570  * @ap:      The 2-bit simple AP (AP[2:1])
571  * @is_user: TRUE if accessing from PL0
572  */
573 static int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
574 {
575     switch (ap) {
576     case 0:
577         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
578     case 1:
579         return PAGE_READ | PAGE_WRITE;
580     case 2:
581         return is_user ? 0 : PAGE_READ;
582     case 3:
583         return PAGE_READ;
584     default:
585         g_assert_not_reached();
586     }
587 }
588 
589 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
590 {
591     return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
592 }
593 
594 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
595                              uint32_t address, MMUAccessType access_type,
596                              GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
597 {
598     int level = 1;
599     uint32_t table;
600     uint32_t desc;
601     int type;
602     int ap;
603     int domain = 0;
604     int domain_prot;
605     hwaddr phys_addr;
606     uint32_t dacr;
607 
608     /* Pagetable walk.  */
609     /* Lookup l1 descriptor.  */
610     if (!get_level1_table_address(env, ptw->in_mmu_idx, &table, address)) {
611         /* Section translation fault if page walk is disabled by PD0 or PD1 */
612         fi->type = ARMFault_Translation;
613         goto do_fault;
614     }
615     if (!S1_ptw_translate(env, ptw, table, fi)) {
616         goto do_fault;
617     }
618     desc = arm_ldl_ptw(env, ptw, fi);
619     if (fi->type != ARMFault_None) {
620         goto do_fault;
621     }
622     type = (desc & 3);
623     domain = (desc >> 5) & 0x0f;
624     if (regime_el(env, ptw->in_mmu_idx) == 1) {
625         dacr = env->cp15.dacr_ns;
626     } else {
627         dacr = env->cp15.dacr_s;
628     }
629     domain_prot = (dacr >> (domain * 2)) & 3;
630     if (type == 0) {
631         /* Section translation fault.  */
632         fi->type = ARMFault_Translation;
633         goto do_fault;
634     }
635     if (type != 2) {
636         level = 2;
637     }
638     if (domain_prot == 0 || domain_prot == 2) {
639         fi->type = ARMFault_Domain;
640         goto do_fault;
641     }
642     if (type == 2) {
643         /* 1Mb section.  */
644         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
645         ap = (desc >> 10) & 3;
646         result->f.lg_page_size = 20; /* 1MB */
647     } else {
648         /* Lookup l2 entry.  */
649         if (type == 1) {
650             /* Coarse pagetable.  */
651             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
652         } else {
653             /* Fine pagetable.  */
654             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
655         }
656         if (!S1_ptw_translate(env, ptw, table, fi)) {
657             goto do_fault;
658         }
659         desc = arm_ldl_ptw(env, ptw, fi);
660         if (fi->type != ARMFault_None) {
661             goto do_fault;
662         }
663         switch (desc & 3) {
664         case 0: /* Page translation fault.  */
665             fi->type = ARMFault_Translation;
666             goto do_fault;
667         case 1: /* 64k page.  */
668             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
669             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
670             result->f.lg_page_size = 16;
671             break;
672         case 2: /* 4k page.  */
673             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
674             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
675             result->f.lg_page_size = 12;
676             break;
677         case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
678             if (type == 1) {
679                 /* ARMv6/XScale extended small page format */
680                 if (arm_feature(env, ARM_FEATURE_XSCALE)
681                     || arm_feature(env, ARM_FEATURE_V6)) {
682                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
683                     result->f.lg_page_size = 12;
684                 } else {
685                     /*
686                      * UNPREDICTABLE in ARMv5; we choose to take a
687                      * page translation fault.
688                      */
689                     fi->type = ARMFault_Translation;
690                     goto do_fault;
691                 }
692             } else {
693                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
694                 result->f.lg_page_size = 10;
695             }
696             ap = (desc >> 4) & 3;
697             break;
698         default:
699             /* Never happens, but compiler isn't smart enough to tell.  */
700             g_assert_not_reached();
701         }
702     }
703     result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot);
704     result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
705     if (!(result->f.prot & (1 << access_type))) {
706         /* Access permission fault.  */
707         fi->type = ARMFault_Permission;
708         goto do_fault;
709     }
710     result->f.phys_addr = phys_addr;
711     return false;
712 do_fault:
713     fi->domain = domain;
714     fi->level = level;
715     return true;
716 }
717 
718 static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
719                              uint32_t address, MMUAccessType access_type,
720                              GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
721 {
722     ARMCPU *cpu = env_archcpu(env);
723     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
724     int level = 1;
725     uint32_t table;
726     uint32_t desc;
727     uint32_t xn;
728     uint32_t pxn = 0;
729     int type;
730     int ap;
731     int domain = 0;
732     int domain_prot;
733     hwaddr phys_addr;
734     uint32_t dacr;
735     bool ns;
736     int user_prot;
737 
738     /* Pagetable walk.  */
739     /* Lookup l1 descriptor.  */
740     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
741         /* Section translation fault if page walk is disabled by PD0 or PD1 */
742         fi->type = ARMFault_Translation;
743         goto do_fault;
744     }
745     if (!S1_ptw_translate(env, ptw, table, fi)) {
746         goto do_fault;
747     }
748     desc = arm_ldl_ptw(env, ptw, fi);
749     if (fi->type != ARMFault_None) {
750         goto do_fault;
751     }
752     type = (desc & 3);
753     if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
754         /* Section translation fault, or attempt to use the encoding
755          * which is Reserved on implementations without PXN.
756          */
757         fi->type = ARMFault_Translation;
758         goto do_fault;
759     }
760     if ((type == 1) || !(desc & (1 << 18))) {
761         /* Page or Section.  */
762         domain = (desc >> 5) & 0x0f;
763     }
764     if (regime_el(env, mmu_idx) == 1) {
765         dacr = env->cp15.dacr_ns;
766     } else {
767         dacr = env->cp15.dacr_s;
768     }
769     if (type == 1) {
770         level = 2;
771     }
772     domain_prot = (dacr >> (domain * 2)) & 3;
773     if (domain_prot == 0 || domain_prot == 2) {
774         /* Section or Page domain fault */
775         fi->type = ARMFault_Domain;
776         goto do_fault;
777     }
778     if (type != 1) {
779         if (desc & (1 << 18)) {
780             /* Supersection.  */
781             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
782             phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
783             phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
784             result->f.lg_page_size = 24;  /* 16MB */
785         } else {
786             /* Section.  */
787             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
788             result->f.lg_page_size = 20;  /* 1MB */
789         }
790         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
791         xn = desc & (1 << 4);
792         pxn = desc & 1;
793         ns = extract32(desc, 19, 1);
794     } else {
795         if (cpu_isar_feature(aa32_pxn, cpu)) {
796             pxn = (desc >> 2) & 1;
797         }
798         ns = extract32(desc, 3, 1);
799         /* Lookup l2 entry.  */
800         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
801         if (!S1_ptw_translate(env, ptw, table, fi)) {
802             goto do_fault;
803         }
804         desc = arm_ldl_ptw(env, ptw, fi);
805         if (fi->type != ARMFault_None) {
806             goto do_fault;
807         }
808         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
809         switch (desc & 3) {
810         case 0: /* Page translation fault.  */
811             fi->type = ARMFault_Translation;
812             goto do_fault;
813         case 1: /* 64k page.  */
814             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
815             xn = desc & (1 << 15);
816             result->f.lg_page_size = 16;
817             break;
818         case 2: case 3: /* 4k page.  */
819             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
820             xn = desc & 1;
821             result->f.lg_page_size = 12;
822             break;
823         default:
824             /* Never happens, but compiler isn't smart enough to tell.  */
825             g_assert_not_reached();
826         }
827     }
828     if (domain_prot == 3) {
829         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
830     } else {
831         if (pxn && !regime_is_user(env, mmu_idx)) {
832             xn = 1;
833         }
834         if (xn && access_type == MMU_INST_FETCH) {
835             fi->type = ARMFault_Permission;
836             goto do_fault;
837         }
838 
839         if (arm_feature(env, ARM_FEATURE_V6K) &&
840                 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
841             /* The simplified model uses AP[0] as an access control bit.  */
842             if ((ap & 1) == 0) {
843                 /* Access flag fault.  */
844                 fi->type = ARMFault_AccessFlag;
845                 goto do_fault;
846             }
847             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
848             user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1);
849         } else {
850             result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
851             user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1);
852         }
853         if (result->f.prot && !xn) {
854             result->f.prot |= PAGE_EXEC;
855         }
856         if (!(result->f.prot & (1 << access_type))) {
857             /* Access permission fault.  */
858             fi->type = ARMFault_Permission;
859             goto do_fault;
860         }
861         if (regime_is_pan(env, mmu_idx) &&
862             !regime_is_user(env, mmu_idx) &&
863             user_prot &&
864             access_type != MMU_INST_FETCH) {
865             /* Privileged Access Never fault */
866             fi->type = ARMFault_Permission;
867             goto do_fault;
868         }
869     }
870     if (ns) {
871         /* The NS bit will (as required by the architecture) have no effect if
872          * the CPU doesn't support TZ or this is a non-secure translation
873          * regime, because the attribute will already be non-secure.
874          */
875         result->f.attrs.secure = false;
876     }
877     result->f.phys_addr = phys_addr;
878     return false;
879 do_fault:
880     fi->domain = domain;
881     fi->level = level;
882     return true;
883 }
884 
885 /*
886  * Translate S2 section/page access permissions to protection flags
887  * @env:     CPUARMState
888  * @s2ap:    The 2-bit stage2 access permissions (S2AP)
889  * @xn:      XN (execute-never) bits
890  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
891  */
892 static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
893 {
894     int prot = 0;
895 
896     if (s2ap & 1) {
897         prot |= PAGE_READ;
898     }
899     if (s2ap & 2) {
900         prot |= PAGE_WRITE;
901     }
902 
903     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
904         switch (xn) {
905         case 0:
906             prot |= PAGE_EXEC;
907             break;
908         case 1:
909             if (s1_is_el0) {
910                 prot |= PAGE_EXEC;
911             }
912             break;
913         case 2:
914             break;
915         case 3:
916             if (!s1_is_el0) {
917                 prot |= PAGE_EXEC;
918             }
919             break;
920         default:
921             g_assert_not_reached();
922         }
923     } else {
924         if (!extract32(xn, 1, 1)) {
925             if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
926                 prot |= PAGE_EXEC;
927             }
928         }
929     }
930     return prot;
931 }
932 
933 /*
934  * Translate section/page access permissions to protection flags
935  * @env:     CPUARMState
936  * @mmu_idx: MMU index indicating required translation regime
937  * @is_aa64: TRUE if AArch64
938  * @ap:      The 2-bit simple AP (AP[2:1])
939  * @ns:      NS (non-secure) bit
940  * @xn:      XN (execute-never) bit
941  * @pxn:     PXN (privileged execute-never) bit
942  */
943 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
944                       int ap, int ns, int xn, int pxn)
945 {
946     bool is_user = regime_is_user(env, mmu_idx);
947     int prot_rw, user_rw;
948     bool have_wxn;
949     int wxn = 0;
950 
951     assert(!regime_is_stage2(mmu_idx));
952 
953     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
954     if (is_user) {
955         prot_rw = user_rw;
956     } else {
957         if (user_rw && regime_is_pan(env, mmu_idx)) {
958             /* PAN forbids data accesses but doesn't affect insn fetch */
959             prot_rw = 0;
960         } else {
961             prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
962         }
963     }
964 
965     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
966         return prot_rw;
967     }
968 
969     /* TODO have_wxn should be replaced with
970      *   ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
971      * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
972      * compatible processors have EL2, which is required for [U]WXN.
973      */
974     have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
975 
976     if (have_wxn) {
977         wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
978     }
979 
980     if (is_aa64) {
981         if (regime_has_2_ranges(mmu_idx) && !is_user) {
982             xn = pxn || (user_rw & PAGE_WRITE);
983         }
984     } else if (arm_feature(env, ARM_FEATURE_V7)) {
985         switch (regime_el(env, mmu_idx)) {
986         case 1:
987         case 3:
988             if (is_user) {
989                 xn = xn || !(user_rw & PAGE_READ);
990             } else {
991                 int uwxn = 0;
992                 if (have_wxn) {
993                     uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
994                 }
995                 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
996                      (uwxn && (user_rw & PAGE_WRITE));
997             }
998             break;
999         case 2:
1000             break;
1001         }
1002     } else {
1003         xn = wxn = 0;
1004     }
1005 
1006     if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
1007         return prot_rw;
1008     }
1009     return prot_rw | PAGE_EXEC;
1010 }
1011 
1012 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
1013                                           ARMMMUIdx mmu_idx)
1014 {
1015     uint64_t tcr = regime_tcr(env, mmu_idx);
1016     uint32_t el = regime_el(env, mmu_idx);
1017     int select, tsz;
1018     bool epd, hpd;
1019 
1020     assert(mmu_idx != ARMMMUIdx_Stage2_S);
1021 
1022     if (mmu_idx == ARMMMUIdx_Stage2) {
1023         /* VTCR */
1024         bool sext = extract32(tcr, 4, 1);
1025         bool sign = extract32(tcr, 3, 1);
1026 
1027         /*
1028          * If the sign-extend bit is not the same as t0sz[3], the result
1029          * is unpredictable. Flag this as a guest error.
1030          */
1031         if (sign != sext) {
1032             qemu_log_mask(LOG_GUEST_ERROR,
1033                           "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
1034         }
1035         tsz = sextract32(tcr, 0, 4) + 8;
1036         select = 0;
1037         hpd = false;
1038         epd = false;
1039     } else if (el == 2) {
1040         /* HTCR */
1041         tsz = extract32(tcr, 0, 3);
1042         select = 0;
1043         hpd = extract64(tcr, 24, 1);
1044         epd = false;
1045     } else {
1046         int t0sz = extract32(tcr, 0, 3);
1047         int t1sz = extract32(tcr, 16, 3);
1048 
1049         if (t1sz == 0) {
1050             select = va > (0xffffffffu >> t0sz);
1051         } else {
1052             /* Note that we will detect errors later.  */
1053             select = va >= ~(0xffffffffu >> t1sz);
1054         }
1055         if (!select) {
1056             tsz = t0sz;
1057             epd = extract32(tcr, 7, 1);
1058             hpd = extract64(tcr, 41, 1);
1059         } else {
1060             tsz = t1sz;
1061             epd = extract32(tcr, 23, 1);
1062             hpd = extract64(tcr, 42, 1);
1063         }
1064         /* For aarch32, hpd0 is not enabled without t2e as well.  */
1065         hpd &= extract32(tcr, 6, 1);
1066     }
1067 
1068     return (ARMVAParameters) {
1069         .tsz = tsz,
1070         .select = select,
1071         .epd = epd,
1072         .hpd = hpd,
1073     };
1074 }
1075 
1076 /*
1077  * check_s2_mmu_setup
1078  * @cpu:        ARMCPU
1079  * @is_aa64:    True if the translation regime is in AArch64 state
1080  * @startlevel: Suggested starting level
1081  * @inputsize:  Bitsize of IPAs
1082  * @stride:     Page-table stride (See the ARM ARM)
1083  *
1084  * Returns true if the suggested S2 translation parameters are OK and
1085  * false otherwise.
1086  */
1087 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
1088                                int inputsize, int stride, int outputsize)
1089 {
1090     const int grainsize = stride + 3;
1091     int startsizecheck;
1092 
1093     /*
1094      * Negative levels are usually not allowed...
1095      * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
1096      * begins with level -1.  Note that previous feature tests will have
1097      * eliminated this combination if it is not enabled.
1098      */
1099     if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
1100         return false;
1101     }
1102 
1103     startsizecheck = inputsize - ((3 - level) * stride + grainsize);
1104     if (startsizecheck < 1 || startsizecheck > stride + 4) {
1105         return false;
1106     }
1107 
1108     if (is_aa64) {
1109         switch (stride) {
1110         case 13: /* 64KB Pages.  */
1111             if (level == 0 || (level == 1 && outputsize <= 42)) {
1112                 return false;
1113             }
1114             break;
1115         case 11: /* 16KB Pages.  */
1116             if (level == 0 || (level == 1 && outputsize <= 40)) {
1117                 return false;
1118             }
1119             break;
1120         case 9: /* 4KB Pages.  */
1121             if (level == 0 && outputsize <= 42) {
1122                 return false;
1123             }
1124             break;
1125         default:
1126             g_assert_not_reached();
1127         }
1128 
1129         /* Inputsize checks.  */
1130         if (inputsize > outputsize &&
1131             (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
1132             /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
1133             return false;
1134         }
1135     } else {
1136         /* AArch32 only supports 4KB pages. Assert on that.  */
1137         assert(stride == 9);
1138 
1139         if (level == 0) {
1140             return false;
1141         }
1142     }
1143     return true;
1144 }
1145 
1146 /**
1147  * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
1148  *
1149  * Returns false if the translation was successful. Otherwise, phys_ptr,
1150  * attrs, prot and page_size may not be filled in, and the populated fsr
1151  * value provides information on why the translation aborted, in the format
1152  * of a long-format DFSR/IFSR fault register, with the following caveat:
1153  * the WnR bit is never set (the caller must do this).
1154  *
1155  * @env: CPUARMState
1156  * @ptw: Current and next stage parameters for the walk.
1157  * @address: virtual address to get physical address for
1158  * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
1159  * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
1160  *             (so this is a stage 2 page table walk),
1161  *             must be true if this is stage 2 of a stage 1+2
1162  *             walk for an EL0 access. If @mmu_idx is anything else,
1163  *             @s1_is_el0 is ignored.
1164  * @result: set on translation success,
1165  * @fi: set to fault info if the translation fails
1166  */
1167 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
1168                                uint64_t address,
1169                                MMUAccessType access_type, bool s1_is_el0,
1170                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
1171 {
1172     ARMCPU *cpu = env_archcpu(env);
1173     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
1174     bool is_secure = ptw->in_secure;
1175     uint32_t level;
1176     ARMVAParameters param;
1177     uint64_t ttbr;
1178     hwaddr descaddr, indexmask, indexmask_grainsize;
1179     uint32_t tableattrs;
1180     target_ulong page_size;
1181     uint64_t attrs;
1182     int32_t stride;
1183     int addrsize, inputsize, outputsize;
1184     uint64_t tcr = regime_tcr(env, mmu_idx);
1185     int ap, ns, xn, pxn;
1186     uint32_t el = regime_el(env, mmu_idx);
1187     uint64_t descaddrmask;
1188     bool aarch64 = arm_el_is_aa64(env, el);
1189     uint64_t descriptor, new_descriptor;
1190     bool nstable;
1191 
1192     /* TODO: This code does not support shareability levels. */
1193     if (aarch64) {
1194         int ps;
1195 
1196         param = aa64_va_parameters(env, address, mmu_idx,
1197                                    access_type != MMU_INST_FETCH);
1198         level = 0;
1199 
1200         /*
1201          * If TxSZ is programmed to a value larger than the maximum,
1202          * or smaller than the effective minimum, it is IMPLEMENTATION
1203          * DEFINED whether we behave as if the field were programmed
1204          * within bounds, or if a level 0 Translation fault is generated.
1205          *
1206          * With FEAT_LVA, fault on less than minimum becomes required,
1207          * so our choice is to always raise the fault.
1208          */
1209         if (param.tsz_oob) {
1210             goto do_translation_fault;
1211         }
1212 
1213         addrsize = 64 - 8 * param.tbi;
1214         inputsize = 64 - param.tsz;
1215 
1216         /*
1217          * Bound PS by PARANGE to find the effective output address size.
1218          * ID_AA64MMFR0 is a read-only register so values outside of the
1219          * supported mappings can be considered an implementation error.
1220          */
1221         ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
1222         ps = MIN(ps, param.ps);
1223         assert(ps < ARRAY_SIZE(pamax_map));
1224         outputsize = pamax_map[ps];
1225     } else {
1226         param = aa32_va_parameters(env, address, mmu_idx);
1227         level = 1;
1228         addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32);
1229         inputsize = addrsize - param.tsz;
1230         outputsize = 40;
1231     }
1232 
1233     /*
1234      * We determined the region when collecting the parameters, but we
1235      * have not yet validated that the address is valid for the region.
1236      * Extract the top bits and verify that they all match select.
1237      *
1238      * For aa32, if inputsize == addrsize, then we have selected the
1239      * region by exclusion in aa32_va_parameters and there is no more
1240      * validation to do here.
1241      */
1242     if (inputsize < addrsize) {
1243         target_ulong top_bits = sextract64(address, inputsize,
1244                                            addrsize - inputsize);
1245         if (-top_bits != param.select) {
1246             /* The gap between the two regions is a Translation fault */
1247             goto do_translation_fault;
1248         }
1249     }
1250 
1251     stride = arm_granule_bits(param.gran) - 3;
1252 
1253     /*
1254      * Note that QEMU ignores shareability and cacheability attributes,
1255      * so we don't need to do anything with the SH, ORGN, IRGN fields
1256      * in the TTBCR.  Similarly, TTBCR:A1 selects whether we get the
1257      * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
1258      * implement any ASID-like capability so we can ignore it (instead
1259      * we will always flush the TLB any time the ASID is changed).
1260      */
1261     ttbr = regime_ttbr(env, mmu_idx, param.select);
1262 
1263     /*
1264      * Here we should have set up all the parameters for the translation:
1265      * inputsize, ttbr, epd, stride, tbi
1266      */
1267 
1268     if (param.epd) {
1269         /*
1270          * Translation table walk disabled => Translation fault on TLB miss
1271          * Note: This is always 0 on 64-bit EL2 and EL3.
1272          */
1273         goto do_translation_fault;
1274     }
1275 
1276     if (!regime_is_stage2(mmu_idx)) {
1277         /*
1278          * The starting level depends on the virtual address size (which can
1279          * be up to 48 bits) and the translation granule size. It indicates
1280          * the number of strides (stride bits at a time) needed to
1281          * consume the bits of the input address. In the pseudocode this is:
1282          *  level = 4 - RoundUp((inputsize - grainsize) / stride)
1283          * where their 'inputsize' is our 'inputsize', 'grainsize' is
1284          * our 'stride + 3' and 'stride' is our 'stride'.
1285          * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
1286          * = 4 - (inputsize - stride - 3 + stride - 1) / stride
1287          * = 4 - (inputsize - 4) / stride;
1288          */
1289         level = 4 - (inputsize - 4) / stride;
1290     } else {
1291         /*
1292          * For stage 2 translations the starting level is specified by the
1293          * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
1294          */
1295         uint32_t sl0 = extract32(tcr, 6, 2);
1296         uint32_t sl2 = extract64(tcr, 33, 1);
1297         uint32_t startlevel;
1298         bool ok;
1299 
1300         /* SL2 is RES0 unless DS=1 & 4kb granule. */
1301         if (param.ds && stride == 9 && sl2) {
1302             if (sl0 != 0) {
1303                 level = 0;
1304                 goto do_translation_fault;
1305             }
1306             startlevel = -1;
1307         } else if (!aarch64 || stride == 9) {
1308             /* AArch32 or 4KB pages */
1309             startlevel = 2 - sl0;
1310 
1311             if (cpu_isar_feature(aa64_st, cpu)) {
1312                 startlevel &= 3;
1313             }
1314         } else {
1315             /* 16KB or 64KB pages */
1316             startlevel = 3 - sl0;
1317         }
1318 
1319         /* Check that the starting level is valid. */
1320         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
1321                                 inputsize, stride, outputsize);
1322         if (!ok) {
1323             goto do_translation_fault;
1324         }
1325         level = startlevel;
1326     }
1327 
1328     indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3);
1329     indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level)));
1330 
1331     /* Now we can extract the actual base address from the TTBR */
1332     descaddr = extract64(ttbr, 0, 48);
1333 
1334     /*
1335      * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
1336      *
1337      * Otherwise, if the base address is out of range, raise AddressSizeFault.
1338      * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
1339      * but we've just cleared the bits above 47, so simplify the test.
1340      */
1341     if (outputsize > 48) {
1342         descaddr |= extract64(ttbr, 2, 4) << 48;
1343     } else if (descaddr >> outputsize) {
1344         level = 0;
1345         fi->type = ARMFault_AddressSize;
1346         goto do_fault;
1347     }
1348 
1349     /*
1350      * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
1351      * and also to mask out CnP (bit 0) which could validly be non-zero.
1352      */
1353     descaddr &= ~indexmask;
1354 
1355     /*
1356      * For AArch32, the address field in the descriptor goes up to bit 39
1357      * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
1358      * or an AddressSize fault is raised.  So for v8 we extract those SBZ
1359      * bits as part of the address, which will be checked via outputsize.
1360      * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
1361      * the highest bits of a 52-bit output are placed elsewhere.
1362      */
1363     if (param.ds) {
1364         descaddrmask = MAKE_64BIT_MASK(0, 50);
1365     } else if (arm_feature(env, ARM_FEATURE_V8)) {
1366         descaddrmask = MAKE_64BIT_MASK(0, 48);
1367     } else {
1368         descaddrmask = MAKE_64BIT_MASK(0, 40);
1369     }
1370     descaddrmask &= ~indexmask_grainsize;
1371 
1372     /*
1373      * Secure accesses start with the page table in secure memory and
1374      * can be downgraded to non-secure at any step. Non-secure accesses
1375      * remain non-secure. We implement this by just ORing in the NSTable/NS
1376      * bits at each step.
1377      */
1378     tableattrs = is_secure ? 0 : (1 << 4);
1379 
1380  next_level:
1381     descaddr |= (address >> (stride * (4 - level))) & indexmask;
1382     descaddr &= ~7ULL;
1383     nstable = extract32(tableattrs, 4, 1);
1384     if (nstable) {
1385         /*
1386          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
1387          * Assert that the non-secure idx are even, and relative order.
1388          */
1389         QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
1390         QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
1391         QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
1392         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
1393         ptw->in_ptw_idx &= ~1;
1394         ptw->in_secure = false;
1395     }
1396     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
1397         goto do_fault;
1398     }
1399     descriptor = arm_ldq_ptw(env, ptw, fi);
1400     if (fi->type != ARMFault_None) {
1401         goto do_fault;
1402     }
1403     new_descriptor = descriptor;
1404 
1405  restart_atomic_update:
1406     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
1407         /* Invalid, or the Reserved level 3 encoding */
1408         goto do_translation_fault;
1409     }
1410 
1411     descaddr = descriptor & descaddrmask;
1412 
1413     /*
1414      * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
1415      * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
1416      * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
1417      * raise AddressSizeFault.
1418      */
1419     if (outputsize > 48) {
1420         if (param.ds) {
1421             descaddr |= extract64(descriptor, 8, 2) << 50;
1422         } else {
1423             descaddr |= extract64(descriptor, 12, 4) << 48;
1424         }
1425     } else if (descaddr >> outputsize) {
1426         fi->type = ARMFault_AddressSize;
1427         goto do_fault;
1428     }
1429 
1430     if ((descriptor & 2) && (level < 3)) {
1431         /*
1432          * Table entry. The top five bits are attributes which may
1433          * propagate down through lower levels of the table (and
1434          * which are all arranged so that 0 means "no effect", so
1435          * we can gather them up by ORing in the bits at each level).
1436          */
1437         tableattrs |= extract64(descriptor, 59, 5);
1438         level++;
1439         indexmask = indexmask_grainsize;
1440         goto next_level;
1441     }
1442 
1443     /*
1444      * Block entry at level 1 or 2, or page entry at level 3.
1445      * These are basically the same thing, although the number
1446      * of bits we pull in from the vaddr varies. Note that although
1447      * descaddrmask masks enough of the low bits of the descriptor
1448      * to give a correct page or table address, the address field
1449      * in a block descriptor is smaller; so we need to explicitly
1450      * clear the lower bits here before ORing in the low vaddr bits.
1451      *
1452      * Afterward, descaddr is the final physical address.
1453      */
1454     page_size = (1ULL << ((stride * (4 - level)) + 3));
1455     descaddr &= ~(hwaddr)(page_size - 1);
1456     descaddr |= (address & (page_size - 1));
1457 
1458     if (likely(!ptw->in_debug)) {
1459         /*
1460          * Access flag.
1461          * If HA is enabled, prepare to update the descriptor below.
1462          * Otherwise, pass the access fault on to software.
1463          */
1464         if (!(descriptor & (1 << 10))) {
1465             if (param.ha) {
1466                 new_descriptor |= 1 << 10; /* AF */
1467             } else {
1468                 fi->type = ARMFault_AccessFlag;
1469                 goto do_fault;
1470             }
1471         }
1472 
1473         /*
1474          * Dirty Bit.
1475          * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
1476          * bit for writeback. The actual write protection test may still be
1477          * overridden by tableattrs, to be merged below.
1478          */
1479         if (param.hd
1480             && extract64(descriptor, 51, 1)  /* DBM */
1481             && access_type == MMU_DATA_STORE) {
1482             if (regime_is_stage2(mmu_idx)) {
1483                 new_descriptor |= 1ull << 7;    /* set S2AP[1] */
1484             } else {
1485                 new_descriptor &= ~(1ull << 7); /* clear AP[2] */
1486             }
1487         }
1488     }
1489 
1490     /*
1491      * Extract attributes from the (modified) descriptor, and apply
1492      * table descriptors. Stage 2 table descriptors do not include
1493      * any attribute fields. HPD disables all the table attributes
1494      * except NSTable.
1495      */
1496     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
1497     if (!regime_is_stage2(mmu_idx)) {
1498         attrs |= nstable << 5; /* NS */
1499         if (!param.hpd) {
1500             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
1501             /*
1502              * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
1503              * means "force PL1 access only", which means forcing AP[1] to 0.
1504              */
1505             attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
1506             attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
1507         }
1508     }
1509 
1510     ap = extract32(attrs, 6, 2);
1511     if (regime_is_stage2(mmu_idx)) {
1512         ns = mmu_idx == ARMMMUIdx_Stage2;
1513         xn = extract64(attrs, 53, 2);
1514         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
1515     } else {
1516         ns = extract32(attrs, 5, 1);
1517         xn = extract64(attrs, 54, 1);
1518         pxn = extract64(attrs, 53, 1);
1519         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
1520     }
1521 
1522     if (!(result->f.prot & (1 << access_type))) {
1523         fi->type = ARMFault_Permission;
1524         goto do_fault;
1525     }
1526 
1527     /* If FEAT_HAFDBS has made changes, update the PTE. */
1528     if (new_descriptor != descriptor) {
1529         new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
1530         if (fi->type != ARMFault_None) {
1531             goto do_fault;
1532         }
1533         /*
1534          * I_YZSVV says that if the in-memory descriptor has changed,
1535          * then we must use the information in that new value
1536          * (which might include a different output address, different
1537          * attributes, or generate a fault).
1538          * Restart the handling of the descriptor value from scratch.
1539          */
1540         if (new_descriptor != descriptor) {
1541             descriptor = new_descriptor;
1542             goto restart_atomic_update;
1543         }
1544     }
1545 
1546     if (ns) {
1547         /*
1548          * The NS bit will (as required by the architecture) have no effect if
1549          * the CPU doesn't support TZ or this is a non-secure translation
1550          * regime, because the attribute will already be non-secure.
1551          */
1552         result->f.attrs.secure = false;
1553     }
1554 
1555     /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
1556     if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
1557         result->f.guarded = extract64(attrs, 50, 1); /* GP */
1558     }
1559 
1560     if (regime_is_stage2(mmu_idx)) {
1561         result->cacheattrs.is_s2_format = true;
1562         result->cacheattrs.attrs = extract32(attrs, 2, 4);
1563     } else {
1564         /* Index into MAIR registers for cache attributes */
1565         uint8_t attrindx = extract32(attrs, 2, 3);
1566         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
1567         assert(attrindx <= 7);
1568         result->cacheattrs.is_s2_format = false;
1569         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
1570     }
1571 
1572     /*
1573      * For FEAT_LPA2 and effective DS, the SH field in the attributes
1574      * was re-purposed for output address bits.  The SH attribute in
1575      * that case comes from TCR_ELx, which we extracted earlier.
1576      */
1577     if (param.ds) {
1578         result->cacheattrs.shareability = param.sh;
1579     } else {
1580         result->cacheattrs.shareability = extract32(attrs, 8, 2);
1581     }
1582 
1583     result->f.phys_addr = descaddr;
1584     result->f.lg_page_size = ctz64(page_size);
1585     return false;
1586 
1587  do_translation_fault:
1588     fi->type = ARMFault_Translation;
1589  do_fault:
1590     fi->level = level;
1591     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
1592     fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
1593     fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
1594     return true;
1595 }
1596 
1597 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
1598                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
1599                                  bool is_secure, GetPhysAddrResult *result,
1600                                  ARMMMUFaultInfo *fi)
1601 {
1602     int n;
1603     uint32_t mask;
1604     uint32_t base;
1605     bool is_user = regime_is_user(env, mmu_idx);
1606 
1607     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
1608         /* MPU disabled.  */
1609         result->f.phys_addr = address;
1610         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1611         return false;
1612     }
1613 
1614     result->f.phys_addr = address;
1615     for (n = 7; n >= 0; n--) {
1616         base = env->cp15.c6_region[n];
1617         if ((base & 1) == 0) {
1618             continue;
1619         }
1620         mask = 1 << ((base >> 1) & 0x1f);
1621         /* Keep this shift separate from the above to avoid an
1622            (undefined) << 32.  */
1623         mask = (mask << 1) - 1;
1624         if (((base ^ address) & ~mask) == 0) {
1625             break;
1626         }
1627     }
1628     if (n < 0) {
1629         fi->type = ARMFault_Background;
1630         return true;
1631     }
1632 
1633     if (access_type == MMU_INST_FETCH) {
1634         mask = env->cp15.pmsav5_insn_ap;
1635     } else {
1636         mask = env->cp15.pmsav5_data_ap;
1637     }
1638     mask = (mask >> (n * 4)) & 0xf;
1639     switch (mask) {
1640     case 0:
1641         fi->type = ARMFault_Permission;
1642         fi->level = 1;
1643         return true;
1644     case 1:
1645         if (is_user) {
1646             fi->type = ARMFault_Permission;
1647             fi->level = 1;
1648             return true;
1649         }
1650         result->f.prot = PAGE_READ | PAGE_WRITE;
1651         break;
1652     case 2:
1653         result->f.prot = PAGE_READ;
1654         if (!is_user) {
1655             result->f.prot |= PAGE_WRITE;
1656         }
1657         break;
1658     case 3:
1659         result->f.prot = PAGE_READ | PAGE_WRITE;
1660         break;
1661     case 5:
1662         if (is_user) {
1663             fi->type = ARMFault_Permission;
1664             fi->level = 1;
1665             return true;
1666         }
1667         result->f.prot = PAGE_READ;
1668         break;
1669     case 6:
1670         result->f.prot = PAGE_READ;
1671         break;
1672     default:
1673         /* Bad permission.  */
1674         fi->type = ARMFault_Permission;
1675         fi->level = 1;
1676         return true;
1677     }
1678     result->f.prot |= PAGE_EXEC;
1679     return false;
1680 }
1681 
1682 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx,
1683                                          int32_t address, uint8_t *prot)
1684 {
1685     if (!arm_feature(env, ARM_FEATURE_M)) {
1686         *prot = PAGE_READ | PAGE_WRITE;
1687         switch (address) {
1688         case 0xF0000000 ... 0xFFFFFFFF:
1689             if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
1690                 /* hivecs execing is ok */
1691                 *prot |= PAGE_EXEC;
1692             }
1693             break;
1694         case 0x00000000 ... 0x7FFFFFFF:
1695             *prot |= PAGE_EXEC;
1696             break;
1697         }
1698     } else {
1699         /* Default system address map for M profile cores.
1700          * The architecture specifies which regions are execute-never;
1701          * at the MPU level no other checks are defined.
1702          */
1703         switch (address) {
1704         case 0x00000000 ... 0x1fffffff: /* ROM */
1705         case 0x20000000 ... 0x3fffffff: /* SRAM */
1706         case 0x60000000 ... 0x7fffffff: /* RAM */
1707         case 0x80000000 ... 0x9fffffff: /* RAM */
1708             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1709             break;
1710         case 0x40000000 ... 0x5fffffff: /* Peripheral */
1711         case 0xa0000000 ... 0xbfffffff: /* Device */
1712         case 0xc0000000 ... 0xdfffffff: /* Device */
1713         case 0xe0000000 ... 0xffffffff: /* System */
1714             *prot = PAGE_READ | PAGE_WRITE;
1715             break;
1716         default:
1717             g_assert_not_reached();
1718         }
1719     }
1720 }
1721 
1722 static bool m_is_ppb_region(CPUARMState *env, uint32_t address)
1723 {
1724     /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
1725     return arm_feature(env, ARM_FEATURE_M) &&
1726         extract32(address, 20, 12) == 0xe00;
1727 }
1728 
1729 static bool m_is_system_region(CPUARMState *env, uint32_t address)
1730 {
1731     /*
1732      * True if address is in the M profile system region
1733      * 0xe0000000 - 0xffffffff
1734      */
1735     return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
1736 }
1737 
1738 static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx,
1739                                          bool is_secure, bool is_user)
1740 {
1741     /*
1742      * Return true if we should use the default memory map as a
1743      * "background" region if there are no hits against any MPU regions.
1744      */
1745     CPUARMState *env = &cpu->env;
1746 
1747     if (is_user) {
1748         return false;
1749     }
1750 
1751     if (arm_feature(env, ARM_FEATURE_M)) {
1752         return env->v7m.mpu_ctrl[is_secure] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
1753     } else {
1754         return regime_sctlr(env, mmu_idx) & SCTLR_BR;
1755     }
1756 }
1757 
1758 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
1759                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
1760                                  bool secure, GetPhysAddrResult *result,
1761                                  ARMMMUFaultInfo *fi)
1762 {
1763     ARMCPU *cpu = env_archcpu(env);
1764     int n;
1765     bool is_user = regime_is_user(env, mmu_idx);
1766 
1767     result->f.phys_addr = address;
1768     result->f.lg_page_size = TARGET_PAGE_BITS;
1769     result->f.prot = 0;
1770 
1771     if (regime_translation_disabled(env, mmu_idx, secure) ||
1772         m_is_ppb_region(env, address)) {
1773         /*
1774          * MPU disabled or M profile PPB access: use default memory map.
1775          * The other case which uses the default memory map in the
1776          * v7M ARM ARM pseudocode is exception vector reads from the vector
1777          * table. In QEMU those accesses are done in arm_v7m_load_vector(),
1778          * which always does a direct read using address_space_ldl(), rather
1779          * than going via this function, so we don't need to check that here.
1780          */
1781         get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
1782     } else { /* MPU enabled */
1783         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
1784             /* region search */
1785             uint32_t base = env->pmsav7.drbar[n];
1786             uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
1787             uint32_t rmask;
1788             bool srdis = false;
1789 
1790             if (!(env->pmsav7.drsr[n] & 0x1)) {
1791                 continue;
1792             }
1793 
1794             if (!rsize) {
1795                 qemu_log_mask(LOG_GUEST_ERROR,
1796                               "DRSR[%d]: Rsize field cannot be 0\n", n);
1797                 continue;
1798             }
1799             rsize++;
1800             rmask = (1ull << rsize) - 1;
1801 
1802             if (base & rmask) {
1803                 qemu_log_mask(LOG_GUEST_ERROR,
1804                               "DRBAR[%d]: 0x%" PRIx32 " misaligned "
1805                               "to DRSR region size, mask = 0x%" PRIx32 "\n",
1806                               n, base, rmask);
1807                 continue;
1808             }
1809 
1810             if (address < base || address > base + rmask) {
1811                 /*
1812                  * Address not in this region. We must check whether the
1813                  * region covers addresses in the same page as our address.
1814                  * In that case we must not report a size that covers the
1815                  * whole page for a subsequent hit against a different MPU
1816                  * region or the background region, because it would result in
1817                  * incorrect TLB hits for subsequent accesses to addresses that
1818                  * are in this MPU region.
1819                  */
1820                 if (ranges_overlap(base, rmask,
1821                                    address & TARGET_PAGE_MASK,
1822                                    TARGET_PAGE_SIZE)) {
1823                     result->f.lg_page_size = 0;
1824                 }
1825                 continue;
1826             }
1827 
1828             /* Region matched */
1829 
1830             if (rsize >= 8) { /* no subregions for regions < 256 bytes */
1831                 int i, snd;
1832                 uint32_t srdis_mask;
1833 
1834                 rsize -= 3; /* sub region size (power of 2) */
1835                 snd = ((address - base) >> rsize) & 0x7;
1836                 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
1837 
1838                 srdis_mask = srdis ? 0x3 : 0x0;
1839                 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
1840                     /*
1841                      * This will check in groups of 2, 4 and then 8, whether
1842                      * the subregion bits are consistent. rsize is incremented
1843                      * back up to give the region size, considering consistent
1844                      * adjacent subregions as one region. Stop testing if rsize
1845                      * is already big enough for an entire QEMU page.
1846                      */
1847                     int snd_rounded = snd & ~(i - 1);
1848                     uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
1849                                                      snd_rounded + 8, i);
1850                     if (srdis_mask ^ srdis_multi) {
1851                         break;
1852                     }
1853                     srdis_mask = (srdis_mask << i) | srdis_mask;
1854                     rsize++;
1855                 }
1856             }
1857             if (srdis) {
1858                 continue;
1859             }
1860             if (rsize < TARGET_PAGE_BITS) {
1861                 result->f.lg_page_size = rsize;
1862             }
1863             break;
1864         }
1865 
1866         if (n == -1) { /* no hits */
1867             if (!pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
1868                 /* background fault */
1869                 fi->type = ARMFault_Background;
1870                 return true;
1871             }
1872             get_phys_addr_pmsav7_default(env, mmu_idx, address,
1873                                          &result->f.prot);
1874         } else { /* a MPU hit! */
1875             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
1876             uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
1877 
1878             if (m_is_system_region(env, address)) {
1879                 /* System space is always execute never */
1880                 xn = 1;
1881             }
1882 
1883             if (is_user) { /* User mode AP bit decoding */
1884                 switch (ap) {
1885                 case 0:
1886                 case 1:
1887                 case 5:
1888                     break; /* no access */
1889                 case 3:
1890                     result->f.prot |= PAGE_WRITE;
1891                     /* fall through */
1892                 case 2:
1893                 case 6:
1894                     result->f.prot |= PAGE_READ | PAGE_EXEC;
1895                     break;
1896                 case 7:
1897                     /* for v7M, same as 6; for R profile a reserved value */
1898                     if (arm_feature(env, ARM_FEATURE_M)) {
1899                         result->f.prot |= PAGE_READ | PAGE_EXEC;
1900                         break;
1901                     }
1902                     /* fall through */
1903                 default:
1904                     qemu_log_mask(LOG_GUEST_ERROR,
1905                                   "DRACR[%d]: Bad value for AP bits: 0x%"
1906                                   PRIx32 "\n", n, ap);
1907                 }
1908             } else { /* Priv. mode AP bits decoding */
1909                 switch (ap) {
1910                 case 0:
1911                     break; /* no access */
1912                 case 1:
1913                 case 2:
1914                 case 3:
1915                     result->f.prot |= PAGE_WRITE;
1916                     /* fall through */
1917                 case 5:
1918                 case 6:
1919                     result->f.prot |= PAGE_READ | PAGE_EXEC;
1920                     break;
1921                 case 7:
1922                     /* for v7M, same as 6; for R profile a reserved value */
1923                     if (arm_feature(env, ARM_FEATURE_M)) {
1924                         result->f.prot |= PAGE_READ | PAGE_EXEC;
1925                         break;
1926                     }
1927                     /* fall through */
1928                 default:
1929                     qemu_log_mask(LOG_GUEST_ERROR,
1930                                   "DRACR[%d]: Bad value for AP bits: 0x%"
1931                                   PRIx32 "\n", n, ap);
1932                 }
1933             }
1934 
1935             /* execute never */
1936             if (xn) {
1937                 result->f.prot &= ~PAGE_EXEC;
1938             }
1939         }
1940     }
1941 
1942     fi->type = ARMFault_Permission;
1943     fi->level = 1;
1944     return !(result->f.prot & (1 << access_type));
1945 }
1946 
1947 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
1948                        MMUAccessType access_type, ARMMMUIdx mmu_idx,
1949                        bool secure, GetPhysAddrResult *result,
1950                        ARMMMUFaultInfo *fi, uint32_t *mregion)
1951 {
1952     /*
1953      * Perform a PMSAv8 MPU lookup (without also doing the SAU check
1954      * that a full phys-to-virt translation does).
1955      * mregion is (if not NULL) set to the region number which matched,
1956      * or -1 if no region number is returned (MPU off, address did not
1957      * hit a region, address hit in multiple regions).
1958      * If the region hit doesn't cover the entire TARGET_PAGE the address
1959      * is within, then we set the result page_size to 1 to force the
1960      * memory system to use a subpage.
1961      */
1962     ARMCPU *cpu = env_archcpu(env);
1963     bool is_user = regime_is_user(env, mmu_idx);
1964     int n;
1965     int matchregion = -1;
1966     bool hit = false;
1967     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
1968     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
1969 
1970     result->f.lg_page_size = TARGET_PAGE_BITS;
1971     result->f.phys_addr = address;
1972     result->f.prot = 0;
1973     if (mregion) {
1974         *mregion = -1;
1975     }
1976 
1977     /*
1978      * Unlike the ARM ARM pseudocode, we don't need to check whether this
1979      * was an exception vector read from the vector table (which is always
1980      * done using the default system address map), because those accesses
1981      * are done in arm_v7m_load_vector(), which always does a direct
1982      * read using address_space_ldl(), rather than going via this function.
1983      */
1984     if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */
1985         hit = true;
1986     } else if (m_is_ppb_region(env, address)) {
1987         hit = true;
1988     } else {
1989         if (pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
1990             hit = true;
1991         }
1992 
1993         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
1994             /* region search */
1995             /*
1996              * Note that the base address is bits [31:5] from the register
1997              * with bits [4:0] all zeroes, but the limit address is bits
1998              * [31:5] from the register with bits [4:0] all ones.
1999              */
2000             uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f;
2001             uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f;
2002 
2003             if (!(env->pmsav8.rlar[secure][n] & 0x1)) {
2004                 /* Region disabled */
2005                 continue;
2006             }
2007 
2008             if (address < base || address > limit) {
2009                 /*
2010                  * Address not in this region. We must check whether the
2011                  * region covers addresses in the same page as our address.
2012                  * In that case we must not report a size that covers the
2013                  * whole page for a subsequent hit against a different MPU
2014                  * region or the background region, because it would result in
2015                  * incorrect TLB hits for subsequent accesses to addresses that
2016                  * are in this MPU region.
2017                  */
2018                 if (limit >= base &&
2019                     ranges_overlap(base, limit - base + 1,
2020                                    addr_page_base,
2021                                    TARGET_PAGE_SIZE)) {
2022                     result->f.lg_page_size = 0;
2023                 }
2024                 continue;
2025             }
2026 
2027             if (base > addr_page_base || limit < addr_page_limit) {
2028                 result->f.lg_page_size = 0;
2029             }
2030 
2031             if (matchregion != -1) {
2032                 /*
2033                  * Multiple regions match -- always a failure (unlike
2034                  * PMSAv7 where highest-numbered-region wins)
2035                  */
2036                 fi->type = ARMFault_Permission;
2037                 fi->level = 1;
2038                 return true;
2039             }
2040 
2041             matchregion = n;
2042             hit = true;
2043         }
2044     }
2045 
2046     if (!hit) {
2047         /* background fault */
2048         fi->type = ARMFault_Background;
2049         return true;
2050     }
2051 
2052     if (matchregion == -1) {
2053         /* hit using the background region */
2054         get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
2055     } else {
2056         uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
2057         uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
2058         bool pxn = false;
2059 
2060         if (arm_feature(env, ARM_FEATURE_V8_1M)) {
2061             pxn = extract32(env->pmsav8.rlar[secure][matchregion], 4, 1);
2062         }
2063 
2064         if (m_is_system_region(env, address)) {
2065             /* System space is always execute never */
2066             xn = 1;
2067         }
2068 
2069         result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
2070         if (result->f.prot && !xn && !(pxn && !is_user)) {
2071             result->f.prot |= PAGE_EXEC;
2072         }
2073         /*
2074          * We don't need to look the attribute up in the MAIR0/MAIR1
2075          * registers because that only tells us about cacheability.
2076          */
2077         if (mregion) {
2078             *mregion = matchregion;
2079         }
2080     }
2081 
2082     fi->type = ARMFault_Permission;
2083     fi->level = 1;
2084     return !(result->f.prot & (1 << access_type));
2085 }
2086 
2087 static bool v8m_is_sau_exempt(CPUARMState *env,
2088                               uint32_t address, MMUAccessType access_type)
2089 {
2090     /*
2091      * The architecture specifies that certain address ranges are
2092      * exempt from v8M SAU/IDAU checks.
2093      */
2094     return
2095         (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
2096         (address >= 0xe0000000 && address <= 0xe0002fff) ||
2097         (address >= 0xe000e000 && address <= 0xe000efff) ||
2098         (address >= 0xe002e000 && address <= 0xe002efff) ||
2099         (address >= 0xe0040000 && address <= 0xe0041fff) ||
2100         (address >= 0xe00ff000 && address <= 0xe00fffff);
2101 }
2102 
2103 void v8m_security_lookup(CPUARMState *env, uint32_t address,
2104                          MMUAccessType access_type, ARMMMUIdx mmu_idx,
2105                          bool is_secure, V8M_SAttributes *sattrs)
2106 {
2107     /*
2108      * Look up the security attributes for this address. Compare the
2109      * pseudocode SecurityCheck() function.
2110      * We assume the caller has zero-initialized *sattrs.
2111      */
2112     ARMCPU *cpu = env_archcpu(env);
2113     int r;
2114     bool idau_exempt = false, idau_ns = true, idau_nsc = true;
2115     int idau_region = IREGION_NOTVALID;
2116     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2117     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2118 
2119     if (cpu->idau) {
2120         IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
2121         IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
2122 
2123         iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
2124                    &idau_nsc);
2125     }
2126 
2127     if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
2128         /* 0xf0000000..0xffffffff is always S for insn fetches */
2129         return;
2130     }
2131 
2132     if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
2133         sattrs->ns = !is_secure;
2134         return;
2135     }
2136 
2137     if (idau_region != IREGION_NOTVALID) {
2138         sattrs->irvalid = true;
2139         sattrs->iregion = idau_region;
2140     }
2141 
2142     switch (env->sau.ctrl & 3) {
2143     case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
2144         break;
2145     case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
2146         sattrs->ns = true;
2147         break;
2148     default: /* SAU.ENABLE == 1 */
2149         for (r = 0; r < cpu->sau_sregion; r++) {
2150             if (env->sau.rlar[r] & 1) {
2151                 uint32_t base = env->sau.rbar[r] & ~0x1f;
2152                 uint32_t limit = env->sau.rlar[r] | 0x1f;
2153 
2154                 if (base <= address && limit >= address) {
2155                     if (base > addr_page_base || limit < addr_page_limit) {
2156                         sattrs->subpage = true;
2157                     }
2158                     if (sattrs->srvalid) {
2159                         /*
2160                          * If we hit in more than one region then we must report
2161                          * as Secure, not NS-Callable, with no valid region
2162                          * number info.
2163                          */
2164                         sattrs->ns = false;
2165                         sattrs->nsc = false;
2166                         sattrs->sregion = 0;
2167                         sattrs->srvalid = false;
2168                         break;
2169                     } else {
2170                         if (env->sau.rlar[r] & 2) {
2171                             sattrs->nsc = true;
2172                         } else {
2173                             sattrs->ns = true;
2174                         }
2175                         sattrs->srvalid = true;
2176                         sattrs->sregion = r;
2177                     }
2178                 } else {
2179                     /*
2180                      * Address not in this region. We must check whether the
2181                      * region covers addresses in the same page as our address.
2182                      * In that case we must not report a size that covers the
2183                      * whole page for a subsequent hit against a different MPU
2184                      * region or the background region, because it would result
2185                      * in incorrect TLB hits for subsequent accesses to
2186                      * addresses that are in this MPU region.
2187                      */
2188                     if (limit >= base &&
2189                         ranges_overlap(base, limit - base + 1,
2190                                        addr_page_base,
2191                                        TARGET_PAGE_SIZE)) {
2192                         sattrs->subpage = true;
2193                     }
2194                 }
2195             }
2196         }
2197         break;
2198     }
2199 
2200     /*
2201      * The IDAU will override the SAU lookup results if it specifies
2202      * higher security than the SAU does.
2203      */
2204     if (!idau_ns) {
2205         if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
2206             sattrs->ns = false;
2207             sattrs->nsc = idau_nsc;
2208         }
2209     }
2210 }
2211 
2212 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
2213                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
2214                                  bool secure, GetPhysAddrResult *result,
2215                                  ARMMMUFaultInfo *fi)
2216 {
2217     V8M_SAttributes sattrs = {};
2218     bool ret;
2219 
2220     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2221         v8m_security_lookup(env, address, access_type, mmu_idx,
2222                             secure, &sattrs);
2223         if (access_type == MMU_INST_FETCH) {
2224             /*
2225              * Instruction fetches always use the MMU bank and the
2226              * transaction attribute determined by the fetch address,
2227              * regardless of CPU state. This is painful for QEMU
2228              * to handle, because it would mean we need to encode
2229              * into the mmu_idx not just the (user, negpri) information
2230              * for the current security state but also that for the
2231              * other security state, which would balloon the number
2232              * of mmu_idx values needed alarmingly.
2233              * Fortunately we can avoid this because it's not actually
2234              * possible to arbitrarily execute code from memory with
2235              * the wrong security attribute: it will always generate
2236              * an exception of some kind or another, apart from the
2237              * special case of an NS CPU executing an SG instruction
2238              * in S&NSC memory. So we always just fail the translation
2239              * here and sort things out in the exception handler
2240              * (including possibly emulating an SG instruction).
2241              */
2242             if (sattrs.ns != !secure) {
2243                 if (sattrs.nsc) {
2244                     fi->type = ARMFault_QEMU_NSCExec;
2245                 } else {
2246                     fi->type = ARMFault_QEMU_SFault;
2247                 }
2248                 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2249                 result->f.phys_addr = address;
2250                 result->f.prot = 0;
2251                 return true;
2252             }
2253         } else {
2254             /*
2255              * For data accesses we always use the MMU bank indicated
2256              * by the current CPU state, but the security attributes
2257              * might downgrade a secure access to nonsecure.
2258              */
2259             if (sattrs.ns) {
2260                 result->f.attrs.secure = false;
2261             } else if (!secure) {
2262                 /*
2263                  * NS access to S memory must fault.
2264                  * Architecturally we should first check whether the
2265                  * MPU information for this address indicates that we
2266                  * are doing an unaligned access to Device memory, which
2267                  * should generate a UsageFault instead. QEMU does not
2268                  * currently check for that kind of unaligned access though.
2269                  * If we added it we would need to do so as a special case
2270                  * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
2271                  */
2272                 fi->type = ARMFault_QEMU_SFault;
2273                 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2274                 result->f.phys_addr = address;
2275                 result->f.prot = 0;
2276                 return true;
2277             }
2278         }
2279     }
2280 
2281     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
2282                             result, fi, NULL);
2283     if (sattrs.subpage) {
2284         result->f.lg_page_size = 0;
2285     }
2286     return ret;
2287 }
2288 
2289 /*
2290  * Translate from the 4-bit stage 2 representation of
2291  * memory attributes (without cache-allocation hints) to
2292  * the 8-bit representation of the stage 1 MAIR registers
2293  * (which includes allocation hints).
2294  *
2295  * ref: shared/translation/attrs/S2AttrDecode()
2296  *      .../S2ConvertAttrsHints()
2297  */
2298 static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs)
2299 {
2300     uint8_t hiattr = extract32(s2attrs, 2, 2);
2301     uint8_t loattr = extract32(s2attrs, 0, 2);
2302     uint8_t hihint = 0, lohint = 0;
2303 
2304     if (hiattr != 0) { /* normal memory */
2305         if (hcr & HCR_CD) { /* cache disabled */
2306             hiattr = loattr = 1; /* non-cacheable */
2307         } else {
2308             if (hiattr != 1) { /* Write-through or write-back */
2309                 hihint = 3; /* RW allocate */
2310             }
2311             if (loattr != 1) { /* Write-through or write-back */
2312                 lohint = 3; /* RW allocate */
2313             }
2314         }
2315     }
2316 
2317     return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
2318 }
2319 
2320 /*
2321  * Combine either inner or outer cacheability attributes for normal
2322  * memory, according to table D4-42 and pseudocode procedure
2323  * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
2324  *
2325  * NB: only stage 1 includes allocation hints (RW bits), leading to
2326  * some asymmetry.
2327  */
2328 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
2329 {
2330     if (s1 == 4 || s2 == 4) {
2331         /* non-cacheable has precedence */
2332         return 4;
2333     } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
2334         /* stage 1 write-through takes precedence */
2335         return s1;
2336     } else if (extract32(s2, 2, 2) == 2) {
2337         /* stage 2 write-through takes precedence, but the allocation hint
2338          * is still taken from stage 1
2339          */
2340         return (2 << 2) | extract32(s1, 0, 2);
2341     } else { /* write-back */
2342         return s1;
2343     }
2344 }
2345 
2346 /*
2347  * Combine the memory type and cacheability attributes of
2348  * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
2349  * combined attributes in MAIR_EL1 format.
2350  */
2351 static uint8_t combined_attrs_nofwb(uint64_t hcr,
2352                                     ARMCacheAttrs s1, ARMCacheAttrs s2)
2353 {
2354     uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs;
2355 
2356     s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs);
2357 
2358     s1lo = extract32(s1.attrs, 0, 4);
2359     s2lo = extract32(s2_mair_attrs, 0, 4);
2360     s1hi = extract32(s1.attrs, 4, 4);
2361     s2hi = extract32(s2_mair_attrs, 4, 4);
2362 
2363     /* Combine memory type and cacheability attributes */
2364     if (s1hi == 0 || s2hi == 0) {
2365         /* Device has precedence over normal */
2366         if (s1lo == 0 || s2lo == 0) {
2367             /* nGnRnE has precedence over anything */
2368             ret_attrs = 0;
2369         } else if (s1lo == 4 || s2lo == 4) {
2370             /* non-Reordering has precedence over Reordering */
2371             ret_attrs = 4;  /* nGnRE */
2372         } else if (s1lo == 8 || s2lo == 8) {
2373             /* non-Gathering has precedence over Gathering */
2374             ret_attrs = 8;  /* nGRE */
2375         } else {
2376             ret_attrs = 0xc; /* GRE */
2377         }
2378     } else { /* Normal memory */
2379         /* Outer/inner cacheability combine independently */
2380         ret_attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
2381                   | combine_cacheattr_nibble(s1lo, s2lo);
2382     }
2383     return ret_attrs;
2384 }
2385 
2386 static uint8_t force_cacheattr_nibble_wb(uint8_t attr)
2387 {
2388     /*
2389      * Given the 4 bits specifying the outer or inner cacheability
2390      * in MAIR format, return a value specifying Normal Write-Back,
2391      * with the allocation and transient hints taken from the input
2392      * if the input specified some kind of cacheable attribute.
2393      */
2394     if (attr == 0 || attr == 4) {
2395         /*
2396          * 0 == an UNPREDICTABLE encoding
2397          * 4 == Non-cacheable
2398          * Either way, force Write-Back RW allocate non-transient
2399          */
2400         return 0xf;
2401     }
2402     /* Change WriteThrough to WriteBack, keep allocation and transient hints */
2403     return attr | 4;
2404 }
2405 
2406 /*
2407  * Combine the memory type and cacheability attributes of
2408  * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
2409  * combined attributes in MAIR_EL1 format.
2410  */
2411 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
2412 {
2413     switch (s2.attrs) {
2414     case 7:
2415         /* Use stage 1 attributes */
2416         return s1.attrs;
2417     case 6:
2418         /*
2419          * Force Normal Write-Back. Note that if S1 is Normal cacheable
2420          * then we take the allocation hints from it; otherwise it is
2421          * RW allocate, non-transient.
2422          */
2423         if ((s1.attrs & 0xf0) == 0) {
2424             /* S1 is Device */
2425             return 0xff;
2426         }
2427         /* Need to check the Inner and Outer nibbles separately */
2428         return force_cacheattr_nibble_wb(s1.attrs & 0xf) |
2429             force_cacheattr_nibble_wb(s1.attrs >> 4) << 4;
2430     case 5:
2431         /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */
2432         if ((s1.attrs & 0xf0) == 0) {
2433             return s1.attrs;
2434         }
2435         return 0x44;
2436     case 0 ... 3:
2437         /* Force Device, of subtype specified by S2 */
2438         return s2.attrs << 2;
2439     default:
2440         /*
2441          * RESERVED values (including RES0 descriptor bit [5] being nonzero);
2442          * arbitrarily force Device.
2443          */
2444         return 0;
2445     }
2446 }
2447 
2448 /*
2449  * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
2450  * and CombineS1S2Desc()
2451  *
2452  * @env:     CPUARMState
2453  * @s1:      Attributes from stage 1 walk
2454  * @s2:      Attributes from stage 2 walk
2455  */
2456 static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
2457                                         ARMCacheAttrs s1, ARMCacheAttrs s2)
2458 {
2459     ARMCacheAttrs ret;
2460     bool tagged = false;
2461 
2462     assert(s2.is_s2_format && !s1.is_s2_format);
2463     ret.is_s2_format = false;
2464 
2465     if (s1.attrs == 0xf0) {
2466         tagged = true;
2467         s1.attrs = 0xff;
2468     }
2469 
2470     /* Combine shareability attributes (table D4-43) */
2471     if (s1.shareability == 2 || s2.shareability == 2) {
2472         /* if either are outer-shareable, the result is outer-shareable */
2473         ret.shareability = 2;
2474     } else if (s1.shareability == 3 || s2.shareability == 3) {
2475         /* if either are inner-shareable, the result is inner-shareable */
2476         ret.shareability = 3;
2477     } else {
2478         /* both non-shareable */
2479         ret.shareability = 0;
2480     }
2481 
2482     /* Combine memory type and cacheability attributes */
2483     if (hcr & HCR_FWB) {
2484         ret.attrs = combined_attrs_fwb(s1, s2);
2485     } else {
2486         ret.attrs = combined_attrs_nofwb(hcr, s1, s2);
2487     }
2488 
2489     /*
2490      * Any location for which the resultant memory type is any
2491      * type of Device memory is always treated as Outer Shareable.
2492      * Any location for which the resultant memory type is Normal
2493      * Inner Non-cacheable, Outer Non-cacheable is always treated
2494      * as Outer Shareable.
2495      * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC
2496      */
2497     if ((ret.attrs & 0xf0) == 0 || ret.attrs == 0x44) {
2498         ret.shareability = 2;
2499     }
2500 
2501     /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */
2502     if (tagged && ret.attrs == 0xff) {
2503         ret.attrs = 0xf0;
2504     }
2505 
2506     return ret;
2507 }
2508 
2509 /*
2510  * MMU disabled.  S1 addresses within aa64 translation regimes are
2511  * still checked for bounds -- see AArch64.S1DisabledOutput().
2512  */
2513 static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
2514                                    MMUAccessType access_type,
2515                                    ARMMMUIdx mmu_idx, bool is_secure,
2516                                    GetPhysAddrResult *result,
2517                                    ARMMMUFaultInfo *fi)
2518 {
2519     uint8_t memattr = 0x00;    /* Device nGnRnE */
2520     uint8_t shareability = 0;  /* non-sharable */
2521     int r_el;
2522 
2523     switch (mmu_idx) {
2524     case ARMMMUIdx_Stage2:
2525     case ARMMMUIdx_Stage2_S:
2526     case ARMMMUIdx_Phys_NS:
2527     case ARMMMUIdx_Phys_S:
2528         break;
2529 
2530     default:
2531         r_el = regime_el(env, mmu_idx);
2532         if (arm_el_is_aa64(env, r_el)) {
2533             int pamax = arm_pamax(env_archcpu(env));
2534             uint64_t tcr = env->cp15.tcr_el[r_el];
2535             int addrtop, tbi;
2536 
2537             tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
2538             if (access_type == MMU_INST_FETCH) {
2539                 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
2540             }
2541             tbi = (tbi >> extract64(address, 55, 1)) & 1;
2542             addrtop = (tbi ? 55 : 63);
2543 
2544             if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
2545                 fi->type = ARMFault_AddressSize;
2546                 fi->level = 0;
2547                 fi->stage2 = false;
2548                 return 1;
2549             }
2550 
2551             /*
2552              * When TBI is disabled, we've just validated that all of the
2553              * bits above PAMax are zero, so logically we only need to
2554              * clear the top byte for TBI.  But it's clearer to follow
2555              * the pseudocode set of addrdesc.paddress.
2556              */
2557             address = extract64(address, 0, 52);
2558         }
2559 
2560         /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
2561         if (r_el == 1) {
2562             uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
2563             if (hcr & HCR_DC) {
2564                 if (hcr & HCR_DCT) {
2565                     memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
2566                 } else {
2567                     memattr = 0xff;  /* Normal, WB, RWA */
2568                 }
2569             }
2570         }
2571         if (memattr == 0 && access_type == MMU_INST_FETCH) {
2572             if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
2573                 memattr = 0xee;  /* Normal, WT, RA, NT */
2574             } else {
2575                 memattr = 0x44;  /* Normal, NC, No */
2576             }
2577             shareability = 2; /* outer sharable */
2578         }
2579         result->cacheattrs.is_s2_format = false;
2580         break;
2581     }
2582 
2583     result->f.phys_addr = address;
2584     result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
2585     result->f.lg_page_size = TARGET_PAGE_BITS;
2586     result->cacheattrs.shareability = shareability;
2587     result->cacheattrs.attrs = memattr;
2588     return false;
2589 }
2590 
2591 static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
2592                                    target_ulong address,
2593                                    MMUAccessType access_type,
2594                                    GetPhysAddrResult *result,
2595                                    ARMMMUFaultInfo *fi)
2596 {
2597     hwaddr ipa;
2598     int s1_prot, s1_lgpgsz;
2599     bool is_secure = ptw->in_secure;
2600     bool ret, ipa_secure, s2walk_secure;
2601     ARMCacheAttrs cacheattrs1;
2602     bool is_el0;
2603     uint64_t hcr;
2604 
2605     ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
2606 
2607     /* If S1 fails or S2 is disabled, return early.  */
2608     if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) {
2609         return ret;
2610     }
2611 
2612     ipa = result->f.phys_addr;
2613     ipa_secure = result->f.attrs.secure;
2614     if (is_secure) {
2615         /* Select TCR based on the NS bit from the S1 walk. */
2616         s2walk_secure = !(ipa_secure
2617                           ? env->cp15.vstcr_el2 & VSTCR_SW
2618                           : env->cp15.vtcr_el2 & VTCR_NSW);
2619     } else {
2620         assert(!ipa_secure);
2621         s2walk_secure = false;
2622     }
2623 
2624     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
2625     ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
2626     ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
2627     ptw->in_secure = s2walk_secure;
2628 
2629     /*
2630      * S1 is done, now do S2 translation.
2631      * Save the stage1 results so that we may merge prot and cacheattrs later.
2632      */
2633     s1_prot = result->f.prot;
2634     s1_lgpgsz = result->f.lg_page_size;
2635     cacheattrs1 = result->cacheattrs;
2636     memset(result, 0, sizeof(*result));
2637 
2638     ret = get_phys_addr_lpae(env, ptw, ipa, access_type, is_el0, result, fi);
2639     fi->s2addr = ipa;
2640 
2641     /* Combine the S1 and S2 perms.  */
2642     result->f.prot &= s1_prot;
2643 
2644     /* If S2 fails, return early.  */
2645     if (ret) {
2646         return ret;
2647     }
2648 
2649     /*
2650      * Use the maximum of the S1 & S2 page size, so that invalidation
2651      * of pages > TARGET_PAGE_SIZE works correctly.
2652      */
2653     if (result->f.lg_page_size < s1_lgpgsz) {
2654         result->f.lg_page_size = s1_lgpgsz;
2655     }
2656 
2657     /* Combine the S1 and S2 cache attributes. */
2658     hcr = arm_hcr_el2_eff_secstate(env, is_secure);
2659     if (hcr & HCR_DC) {
2660         /*
2661          * HCR.DC forces the first stage attributes to
2662          *  Normal Non-Shareable,
2663          *  Inner Write-Back Read-Allocate Write-Allocate,
2664          *  Outer Write-Back Read-Allocate Write-Allocate.
2665          * Do not overwrite Tagged within attrs.
2666          */
2667         if (cacheattrs1.attrs != 0xf0) {
2668             cacheattrs1.attrs = 0xff;
2669         }
2670         cacheattrs1.shareability = 0;
2671     }
2672     result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1,
2673                                             result->cacheattrs);
2674 
2675     /*
2676      * Check if IPA translates to secure or non-secure PA space.
2677      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
2678      */
2679     result->f.attrs.secure =
2680         (is_secure
2681          && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
2682          && (ipa_secure
2683              || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
2684 
2685     return false;
2686 }
2687 
2688 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
2689                                       target_ulong address,
2690                                       MMUAccessType access_type,
2691                                       GetPhysAddrResult *result,
2692                                       ARMMMUFaultInfo *fi)
2693 {
2694     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2695     bool is_secure = ptw->in_secure;
2696     ARMMMUIdx s1_mmu_idx;
2697 
2698     /*
2699      * The page table entries may downgrade secure to non-secure, but
2700      * cannot upgrade an non-secure translation regime's attributes
2701      * to secure.
2702      */
2703     result->f.attrs.secure = is_secure;
2704 
2705     switch (mmu_idx) {
2706     case ARMMMUIdx_Phys_S:
2707     case ARMMMUIdx_Phys_NS:
2708         /* Checking Phys early avoids special casing later vs regime_el. */
2709         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
2710                                       is_secure, result, fi);
2711 
2712     case ARMMMUIdx_Stage1_E0:
2713     case ARMMMUIdx_Stage1_E1:
2714     case ARMMMUIdx_Stage1_E1_PAN:
2715         /* First stage lookup uses second stage for ptw. */
2716         ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
2717         break;
2718 
2719     case ARMMMUIdx_E10_0:
2720         s1_mmu_idx = ARMMMUIdx_Stage1_E0;
2721         goto do_twostage;
2722     case ARMMMUIdx_E10_1:
2723         s1_mmu_idx = ARMMMUIdx_Stage1_E1;
2724         goto do_twostage;
2725     case ARMMMUIdx_E10_1_PAN:
2726         s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
2727     do_twostage:
2728         /*
2729          * Call ourselves recursively to do the stage 1 and then stage 2
2730          * translations if mmu_idx is a two-stage regime, and EL2 present.
2731          * Otherwise, a stage1+stage2 translation is just stage 1.
2732          */
2733         ptw->in_mmu_idx = mmu_idx = s1_mmu_idx;
2734         if (arm_feature(env, ARM_FEATURE_EL2)) {
2735             return get_phys_addr_twostage(env, ptw, address, access_type,
2736                                           result, fi);
2737         }
2738         /* fall through */
2739 
2740     default:
2741         /* Single stage and second stage uses physical for ptw. */
2742         ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
2743         break;
2744     }
2745 
2746     result->f.attrs.user = regime_is_user(env, mmu_idx);
2747 
2748     /*
2749      * Fast Context Switch Extension. This doesn't exist at all in v8.
2750      * In v7 and earlier it affects all stage 1 translations.
2751      */
2752     if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2
2753         && !arm_feature(env, ARM_FEATURE_V8)) {
2754         if (regime_el(env, mmu_idx) == 3) {
2755             address += env->cp15.fcseidr_s;
2756         } else {
2757             address += env->cp15.fcseidr_ns;
2758         }
2759     }
2760 
2761     if (arm_feature(env, ARM_FEATURE_PMSA)) {
2762         bool ret;
2763         result->f.lg_page_size = TARGET_PAGE_BITS;
2764 
2765         if (arm_feature(env, ARM_FEATURE_V8)) {
2766             /* PMSAv8 */
2767             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
2768                                        is_secure, result, fi);
2769         } else if (arm_feature(env, ARM_FEATURE_V7)) {
2770             /* PMSAv7 */
2771             ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
2772                                        is_secure, result, fi);
2773         } else {
2774             /* Pre-v7 MPU */
2775             ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
2776                                        is_secure, result, fi);
2777         }
2778         qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
2779                       " mmu_idx %u -> %s (prot %c%c%c)\n",
2780                       access_type == MMU_DATA_LOAD ? "reading" :
2781                       (access_type == MMU_DATA_STORE ? "writing" : "execute"),
2782                       (uint32_t)address, mmu_idx,
2783                       ret ? "Miss" : "Hit",
2784                       result->f.prot & PAGE_READ ? 'r' : '-',
2785                       result->f.prot & PAGE_WRITE ? 'w' : '-',
2786                       result->f.prot & PAGE_EXEC ? 'x' : '-');
2787 
2788         return ret;
2789     }
2790 
2791     /* Definitely a real MMU, not an MPU */
2792 
2793     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
2794         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
2795                                       is_secure, result, fi);
2796     }
2797 
2798     if (regime_using_lpae_format(env, mmu_idx)) {
2799         return get_phys_addr_lpae(env, ptw, address, access_type, false,
2800                                   result, fi);
2801     } else if (arm_feature(env, ARM_FEATURE_V7) ||
2802                regime_sctlr(env, mmu_idx) & SCTLR_XP) {
2803         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
2804     } else {
2805         return get_phys_addr_v5(env, ptw, address, access_type, result, fi);
2806     }
2807 }
2808 
2809 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
2810                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
2811                                bool is_secure, GetPhysAddrResult *result,
2812                                ARMMMUFaultInfo *fi)
2813 {
2814     S1Translate ptw = {
2815         .in_mmu_idx = mmu_idx,
2816         .in_secure = is_secure,
2817     };
2818     return get_phys_addr_with_struct(env, &ptw, address, access_type,
2819                                      result, fi);
2820 }
2821 
2822 bool get_phys_addr(CPUARMState *env, target_ulong address,
2823                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
2824                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
2825 {
2826     bool is_secure;
2827 
2828     switch (mmu_idx) {
2829     case ARMMMUIdx_E10_0:
2830     case ARMMMUIdx_E10_1:
2831     case ARMMMUIdx_E10_1_PAN:
2832     case ARMMMUIdx_E20_0:
2833     case ARMMMUIdx_E20_2:
2834     case ARMMMUIdx_E20_2_PAN:
2835     case ARMMMUIdx_Stage1_E0:
2836     case ARMMMUIdx_Stage1_E1:
2837     case ARMMMUIdx_Stage1_E1_PAN:
2838     case ARMMMUIdx_E2:
2839         is_secure = arm_is_secure_below_el3(env);
2840         break;
2841     case ARMMMUIdx_Stage2:
2842     case ARMMMUIdx_Phys_NS:
2843     case ARMMMUIdx_MPrivNegPri:
2844     case ARMMMUIdx_MUserNegPri:
2845     case ARMMMUIdx_MPriv:
2846     case ARMMMUIdx_MUser:
2847         is_secure = false;
2848         break;
2849     case ARMMMUIdx_E3:
2850     case ARMMMUIdx_Stage2_S:
2851     case ARMMMUIdx_Phys_S:
2852     case ARMMMUIdx_MSPrivNegPri:
2853     case ARMMMUIdx_MSUserNegPri:
2854     case ARMMMUIdx_MSPriv:
2855     case ARMMMUIdx_MSUser:
2856         is_secure = true;
2857         break;
2858     default:
2859         g_assert_not_reached();
2860     }
2861     return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
2862                                      is_secure, result, fi);
2863 }
2864 
2865 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
2866                                          MemTxAttrs *attrs)
2867 {
2868     ARMCPU *cpu = ARM_CPU(cs);
2869     CPUARMState *env = &cpu->env;
2870     S1Translate ptw = {
2871         .in_mmu_idx = arm_mmu_idx(env),
2872         .in_secure = arm_is_secure(env),
2873         .in_debug = true,
2874     };
2875     GetPhysAddrResult res = {};
2876     ARMMMUFaultInfo fi = {};
2877     bool ret;
2878 
2879     ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
2880     *attrs = res.f.attrs;
2881 
2882     if (ret) {
2883         return -1;
2884     }
2885     return res.f.phys_addr;
2886 }
2887